https://www.privacylawnetwork.com/news.html Privacy law enforcement, legislation and court rulings, reported from primary sources. en-us Mon, 21 Sep 2026 12:00:00 GMT https://www.privacylawnetwork.com/news/alberta-bc-private-sector-privacy-acts.html https://www.privacylawnetwork.com/news/alberta-bc-private-sector-privacy-acts.html Mon, 21 Sep 2026 12:00:00 GMT Two federal exemption orders registered on the same day in 2004 let Alberta's and British Columbia's private-sector privacy statutes displace PIPEDA inside each province. The Acts share a name and identical fine ceilings, but only Alberta's requires breach reporting, they define employee information and treat non-profits differently, and BC has credit-reporting amendments due in 2027. Canada (PIPEDA) https://www.privacylawnetwork.com/news/anpd-encarregado-regulation.html https://www.privacylawnetwork.com/news/anpd-encarregado-regulation.html Mon, 21 Sep 2026 12:00:00 GMT The LGPD says a controller must appoint an encarregado and publish how to reach them, and leaves the rest to the regulator. Resolution CD/ANPD No. 18 of 16 July 2024 supplies it: a written, dated and signed act of appointment, a named substitute, a minimum content for the public notice, five duties the organisation owes its encarregado, and a conflict-of-interest regime that can lead to sanctions. Brazil (LGPD) https://www.privacylawnetwork.com/news/china-network-data-security-regulations.html https://www.privacylawnetwork.com/news/china-network-data-security-regulations.html Mon, 21 Sep 2026 12:00:00 GMT The Regulations on Network Data Security Management are an administrative regulation of the State Council, made to implement three statutes at once rather than one. They define who a network data processor is, add concrete rules on privacy notices, portability and personalised recommendation, impose annual risk reporting on holders of important data, and set their own fine schedule. China (PIPL) https://www.privacylawnetwork.com/news/china-personal-information-compliance-audits.html https://www.privacylawnetwork.com/news/china-personal-information-compliance-audits.html Mon, 21 Sep 2026 12:00:00 GMT Article 54 of China's Personal Information Protection Law has required regular compliance audits since November 2021, without saying how often, by whom or against what. The CAC's Measures for Personal Information Protection Compliance Audits, in force since 1 May 2025, supply those answers, and add a second route by which a regulator can order an outside audit at the processor's expense. China (PIPL) https://www.privacylawnetwork.com/news/connecticut-data-privacy-act-2025-amendments.html https://www.privacylawnetwork.com/news/connecticut-data-privacy-act-2025-amendments.html Mon, 21 Sep 2026 12:00:00 GMT Substitute Senate Bill 1295 became Public Act 25-113 on June 24, 2025. Its Data Privacy Act sections took effect together on July 1, 2026: a lower threshold, two no-threshold triggers, more sensitive data, profiling rights, impact assessments and a ban on selling teenagers' data. Public Act 26-64 amends several of the same sections again from October 1, 2026. State Comprehensive Privacy Laws https://www.privacylawnetwork.com/news/doj-bulk-sensitive-data-rule.html https://www.privacylawnetwork.com/news/doj-bulk-sensitive-data-rule.html Mon, 21 Sep 2026 12:00:00 GMT Executive Order 14117 directed the Attorney General to bar or condition transactions that give six foreign governments, and persons tied to them, access to Americans' bulk sensitive data. The resulting rule, 28 CFR part 202, took effect April 8, 2025. Its due diligence, audit and reporting duties followed on October 6, 2025. The only change to the text since publication is a one-line correction. Cross-Border Transfers https://www.privacylawnetwork.com/news/doj-civil-cyber-fraud-initiative.html https://www.privacylawnetwork.com/news/doj-civil-cyber-fraud-initiative.html Mon, 21 Sep 2026 12:00:00 GMT The Justice Department launched the Civil Cyber-Fraud Initiative on October 6, 2021 to pursue government contractors and grantees under the False Claims Act for knowing cybersecurity failures. This publication located sixteen resolved matters announced in DOJ releases through September 1, 2026, totaling about $69.1 million. Every one settled, and most began as whistleblower suits. Data Security Rules https://www.privacylawnetwork.com/news/india-data-protection-board-procedure.html https://www.privacylawnetwork.com/news/india-data-protection-board-procedure.html Mon, 21 Sep 2026 12:00:00 GMT The Data Protection Board of India was established by Gazette notification on 13 November 2025, with its head office in the National Capital Region. MeitY invited applications for a Chairperson and four Members in May 2026, and no appointment had been notified by 21 September 2026. This explainer covers its staffing, its digital procedure and which of its powers are not yet in force. India (DPDP Act) https://www.privacylawnetwork.com/news/india-dpdp-breach-intimation.html https://www.privacylawnetwork.com/news/india-dpdp-breach-intimation.html Mon, 21 Sep 2026 12:00:00 GMT Section 8(6) of India's Digital Personal Data Protection Act requires a Data Fiduciary to tell the Data Protection Board and each affected individual about a personal data breach, and rule 7 of the 2025 Rules fills in the content and a 72-hour clock. Both sit in the commencement tranche that starts eighteen months after 13 November 2025, while CERT-In's six-hour incident reporting already applies. India (DPDP Act) https://www.privacylawnetwork.com/news/lgpd-small-processing-agents-regulation.html https://www.privacylawnetwork.com/news/lgpd-small-processing-agents-regulation.html Mon, 21 Sep 2026 12:00:00 GMT Resolution CD/ANPD No. 2 of 2022 gives micro and small enterprises, startups, non-profits and individuals acting as controllers or processors a lighter version of the LGPD: a simplified record of processing, no mandatory encarregado, and doubled deadlines. Three exclusions take it away, the ANPD can withdraw it case by case, and a 2024 regulation rewrote one deadline rule. Brazil (LGPD) https://www.privacylawnetwork.com/news/new-york-child-data-protection-act.html https://www.privacylawnetwork.com/news/new-york-child-data-protection-act.html Mon, 21 Sep 2026 12:00:00 GMT Chapter 121 of the Laws of 2024 added article 39-FF, sections 899-ee to 899-mm, to New York's General Business Law. It has applied since June 20, 2025 to operators whose users are known minors or whose services are primarily directed to minors. The Attorney General issued an advance notice in 2024 and implementation guidance in May 2025, but has not published proposed rules. State Comprehensive Privacy Laws https://www.privacylawnetwork.com/news/opc-meaningful-consent-guidelines.html https://www.privacylawnetwork.com/news/opc-meaningful-consent-guidelines.html Mon, 21 Sep 2026 12:00:00 GMT The Guidelines for obtaining meaningful consent were issued jointly by the federal Privacy Commissioner and the Alberta and British Columbia commissioners in May 2018 and last modified in August 2025. They set seven principles, four elements that must be emphasised, three triggers for express consent and an under-13 position on children, and label each item an obligation or a best practice. Canada (PIPEDA) https://www.privacylawnetwork.com/news/can-spam-commercial-and-transactional-messages.html https://www.privacylawnetwork.com/news/can-spam-commercial-and-transactional-messages.html Mon, 14 Sep 2026 12:00:00 GMT Almost every CAN-SPAM duty depends on a threshold question the statute left to the FTC: is this email commercial, transactional, or something else? The answer comes from a 2005 rule that looks at the subject line, at what sits at the top of the body, and at the overall impression of the message, and the Commission has declined every request since to redraw it. CAN-SPAM https://www.privacylawnetwork.com/news/can-spam-opt-out-mechanics.html https://www.privacylawnetwork.com/news/can-spam-opt-out-mechanics.html Mon, 14 Sep 2026 12:00:00 GMT CAN-SPAM never asks for permission before the first commercial email. Its control is the objection, and the statute and the FTC's rule regulate that objection closely: what channel carries it, how long the channel stays open, how quickly sending stops, what a sender may not demand in exchange, and what may be done with the address afterwards. CAN-SPAM https://www.privacylawnetwork.com/news/cfpb-personal-financial-data-rights-rule.html https://www.privacylawnetwork.com/news/cfpb-personal-financial-data-rights-rule.html Mon, 14 Sep 2026 12:00:00 GMT The Personal Financial Data Rights Rule, 12 CFR part 1033, requires banks, card issuers and other data providers to make consumer financial data available to consumers and authorized third parties. The rule remains on the books, but since October 29, 2025 the CFPB has been enjoined from enforcing it while it reconsiders the rule, and appeals from that order are paused. GLBA https://www.privacylawnetwork.com/news/circia-cyber-incident-reporting.html https://www.privacylawnetwork.com/news/circia-cyber-incident-reporting.html Mon, 14 Sep 2026 12:00:00 GMT The Cyber Incident Reporting for Critical Infrastructure Act of 2022 wrote two reporting clocks into federal law but left their start date, and the definitions of who reports and what, to a CISA rulemaking that was due in October 2025. This sets out what the statute fixes, what the 2024 proposal would add, and where the rulemaking stood on September 14, 2026. Ransomware Breach Notification https://www.privacylawnetwork.com/news/ftc-negative-option-rule.html https://www.privacylawnetwork.com/news/ftc-negative-option-rule.html Mon, 14 Sep 2026 12:00:00 GMT Between late 2024 and early 2026, 16 CFR Part 425 said three different things. The FTC's click-to-cancel amendments took effect, were vacated by the Eighth Circuit on procedural grounds weeks before full compliance was due, and were replaced by the 1973 book-club rule. This sets out what each version says, why the court ruled as it did, and what federal law governs online subscriptions today. Dark Patterns FTC Enforcement https://www.privacylawnetwork.com/news/ico-fining-guidance.html https://www.privacylawnetwork.com/news/ico-fining-guidance.html Mon, 14 Sep 2026 12:00:00 GMT The Information Commissioner's Office published its Data Protection Fining Guidance on 18 March 2024 under section 160 of the Data Protection Act 2018. It explains when the regulator issues a penalty notice and how it reaches an amount, from a seriousness band through a turnover adjustment to a final check against the statutory cap. Both are set out here. UK Data Protection https://www.privacylawnetwork.com/news/insurance-data-security-model-law.html https://www.privacylawnetwork.com/news/insurance-data-security-model-law.html Mon, 14 Sep 2026 12:00:00 GMT The NAIC adopted its Insurance Data Security Model Law in late 2017 as a template for state legislatures. It asks insurance licensees to run a written information security program, oversee vendors, investigate cybersecurity events and notify the insurance commissioner within 72 hours. This walks through the model's text and compares it with eight enacted state versions. Data Security Rules https://www.privacylawnetwork.com/news/maryland-online-data-privacy-act.html https://www.privacylawnetwork.com/news/maryland-online-data-privacy-act.html Mon, 14 Sep 2026 12:00:00 GMT The Maryland Online Data Privacy Act has applied since October 1, 2025, but not at the section numbers its bill record gives, or in the form its chapter law's plain text suggests. This post sets out the statute as the General Assembly now publishes it, the Attorney General's reading of its minimization rule, and the immigration-enforcement amendments effective July 1, 2026. State Comprehensive Privacy Laws https://www.privacylawnetwork.com/news/new-york-shield-act-data-security.html https://www.privacylawnetwork.com/news/new-york-shield-act-data-security.html Mon, 14 Sep 2026 12:00:00 GMT The SHIELD Act of 2019 did two things: it widened New York's breach notification statute, General Business Law section 899-aa, and it added section 899-bb, a standalone duty to maintain reasonable data security. This sets out the security requirement as enacted, the routes to deemed compliance, and the three later chapters that changed section 899-aa without touching section 899-bb. Data Security Rules Breach Notification https://www.privacylawnetwork.com/news/ransomware-hipaa-breach-presumption.html https://www.privacylawnetwork.com/news/ransomware-hipaa-breach-presumption.html Mon, 14 Sep 2026 12:00:00 GMT HHS does not treat ransomware as a mere outage outside the breach rules. Its Office for Civil Rights reads encryption by an attacker as an acquisition of the data, which brings the incident within the regulatory presumption of breach at 45 CFR 164.402. This sets out where that presumption came from, what rebutting it involves, and the clocks that follow when it stands. Ransomware HIPAA https://www.privacylawnetwork.com/news/state-dark-pattern-consent-rules.html https://www.privacylawnetwork.com/news/state-dark-pattern-consent-rules.html Mon, 14 Sep 2026 12:00:00 GMT California, Colorado and Connecticut define a dark pattern in nearly the same words, and each treats agreement obtained through one as no consent at all. What differs is the material around that sentence: an example-driven regulation in California, design and withdrawal rules in Colorado, and in Connecticut a statute that points to the FTC. Dark Patterns Consent Management https://www.privacylawnetwork.com/news/vermont-age-appropriate-design-code.html https://www.privacylawnetwork.com/news/vermont-age-appropriate-design-code.html Mon, 14 Sep 2026 12:00:00 GMT Vermont enacted its Age-Appropriate Design Code as Act 63 of 2025, signed June 12, 2025. The substantive duties begin on January 1, 2027, but the Attorney General's rulemaking powers took effect in July 2025 and proposed rules are open for comment until October 2, 2026. This post covers its definitions and duties and compares them with the California provisions the Ninth Circuit has ruled on. State Comprehensive Privacy Laws https://www.privacylawnetwork.com/news/colorado-ai-act-consequential-decisions.html https://www.privacylawnetwork.com/news/colorado-ai-act-consequential-decisions.html Mon, 07 Sep 2026 12:00:00 GMT Colorado's 2024 artificial intelligence statute was delayed once, then repealed and reenacted before it ever took effect. Senate Bill 26-189, signed May 14, 2026, replaced part 17 of article 1 of title 6 with a framework keyed to automated decision-making technology. Consequential decision survived as the trigger; the algorithmic discrimination duty did not. Automated Decision-Making AI & Privacy https://www.privacylawnetwork.com/news/cookie-consent-banner-requirements.html https://www.privacylawnetwork.com/news/cookie-consent-banner-requirements.html Mon, 07 Sep 2026 12:00:00 GMT The banner that greets visitors to most American websites is not a creature of American statute. Neither the CCPA nor the Colorado Privacy Act requires one, and the California regulations mention banners chiefly to say when their design is unlawful. This sets out what each statute requires at the point of collection, and when each genuinely calls for consent. Adtech & Cookies Consent Management https://www.privacylawnetwork.com/news/cppa-rulemaking-authority.html https://www.privacylawnetwork.com/news/cppa-rulemaking-authority.html Mon, 07 Sep 2026 12:00:00 GMT Proposition 24 established the California Privacy Protection Agency in December 2020, but the power to write CCPA regulations did not move to it on that date. The transfer was conditional, it completed in April 2022, and the Attorney General's own regulatory authority was never extinguished. This traces the grant, the condition, the board that exercises it, and what the agency has adopted. CPPA CCPA / CPRA https://www.privacylawnetwork.com/news/employee-electronic-monitoring-notice.html https://www.privacylawnetwork.com/news/employee-electronic-monitoring-notice.html Mon, 07 Sep 2026 12:00:00 GMT Three states condition workplace electronic monitoring on notice rather than on consent, and each builds the requirement differently. Connecticut makes a posted notice the legal notice. New York requires a notice on hiring and a posting. Delaware offers a choice between a daily electronic notice and a one-time acknowledged one. Workplace Monitoring Employee Privacy https://www.privacylawnetwork.com/news/facial-recognition-hiring-consent.html https://www.privacylawnetwork.com/news/facial-recognition-hiring-consent.html Mon, 07 Sep 2026 12:00:00 GMT Three states regulate what happens to an applicant's face during hiring, through four statutes that each define permission differently. Maryland asks for a signed waiver with four listed contents. Illinois asks for notice, an explanation and consent, and separately for a written release. Texas asks only that the individual be informed and consent before capture. Facial Recognition Biometric Privacy Employee Privacy https://www.privacylawnetwork.com/news/fcra-adverse-action-notice.html https://www.privacylawnetwork.com/news/fcra-adverse-action-notice.html Mon, 07 Sep 2026 12:00:00 GMT The Fair Credit Reporting Act does not have one adverse action notice. It has a notice owed before a decision that only employers owe, and a notice owed after any adverse action taken on a consumer report by anyone. The two sit in different sections, carry different contents, and answer to different silences in the statute. FCRA Background Checks https://www.privacylawnetwork.com/news/fcra-standalone-disclosure-requirement.html https://www.privacylawnetwork.com/news/fcra-standalone-disclosure-requirement.html Mon, 07 Sep 2026 12:00:00 GMT Four published Ninth Circuit opinions have construed a single sentence of the Fair Credit Reporting Act: the requirement that an employment background check disclosure appear in a document that consists solely of the disclosure. Read in sequence, Syed, Gilberg, Walker and Luna map what may sit on the page, what the page is, and where the line still has not been drawn. Background Checks FCRA https://www.privacylawnetwork.com/news/new-jersey-employee-vehicle-tracking.html https://www.privacylawnetwork.com/news/new-jersey-employee-vehicle-tracking.html Mon, 07 Sep 2026 12:00:00 GMT New Jersey's tracking device statute, N.J.S.A. 34:6B-22, was approved on January 18, 2022 and took effect ninety days later. It reached that form after four reprints that moved it from a fourth-degree crime to a civil penalty, from written consent to written notice, and from any tracking device to one designed for the sole purpose of tracking. Employee Privacy Workplace Monitoring https://www.privacylawnetwork.com/news/state-data-broker-registries.html https://www.privacylawnetwork.com/news/state-data-broker-registries.html Mon, 07 Sep 2026 12:00:00 GMT Registration statutes are usually compared by what they demand of a filer. They can also be compared by what they hand back to the public, and on that axis the four state registries are not alike. One publishes every answer as a downloadable file; the other three publish a search box. This reports what is readable off each, and what California's file disclosed. Data Brokers https://www.privacylawnetwork.com/news/transunion-ramirez-concrete-harm.html https://www.privacylawnetwork.com/news/transunion-ramirez-concrete-harm.html Mon, 07 Sep 2026 12:00:00 GMT Decided 25 June 2021 by five votes to four, TransUnion LLC v. Ramirez took a jury verdict that had already been returned and removed three quarters of the class from federal court. This post reads the case as a case: the OFAC Name Screen product, the six-day trial, the arithmetic of the award, the reasoning on each of the three claims, and the two dissents. Standing & Damages Privacy Litigation https://www.privacylawnetwork.com/news/uk-data-use-and-access-act.html https://www.privacylawnetwork.com/news/uk-data-use-and-access-act.html Mon, 07 Sep 2026 12:00:00 GMT The Data (Use and Access) Act 2025 is a nine-part statute covering smart data schemes, digital identity, buried pipes, birth registers, data protection, a new regulator and much else. Its commencement is the part most easily got wrong: Royal Assent brought almost none of it into force, and a reader working from the Act alone cannot tell what is law today. UK Data Protection GDPR https://www.privacylawnetwork.com/news/vppa-consumer-definition-circuit-split.html https://www.privacylawnetwork.com/news/vppa-consumer-definition-circuit-split.html Mon, 07 Sep 2026 12:00:00 GMT One phrase in the Video Privacy Protection Act — "goods or services from a video tape service provider" — has produced an open split among three courts of appeals over who may sue. The Supreme Court granted review on 26 January 2026 and has set argument for 14 October 2026. This post sets out what each opinion actually reasoned. VPPA Privacy Litigation https://www.privacylawnetwork.com/news/arbitration-in-privacy-class-actions.html https://www.privacylawnetwork.com/news/arbitration-in-privacy-class-actions.html Tue, 01 Sep 2026 12:00:00 GMT A privacy class action filed against a company whose terms contain an arbitration clause is usually decided on a motion to compel long before any merits ruling. This post describes the Federal Arbitration Act machinery that governs those motions, the online assent cases that determine whether a clause was formed at all, and the narrow categories Congress and state legislatures have carved out. Privacy Class Actions https://www.privacylawnetwork.com/news/california-delete-act-data-broker-registry.html https://www.privacylawnetwork.com/news/california-delete-act-data-broker-registry.html Tue, 01 Sep 2026 12:00:00 GMT California's Delete Act took an existing registry and attached machinery to it: one consumer request that reaches every registered broker, a 45-day processing cycle, a triennial third-party audit and a $200-a-day fine for not signing up. This reports what SB 362 and the 2025 amendment require, and the dates the statute and the DROP regulations set. Data Brokers CCPA / CPRA CPPA https://www.privacylawnetwork.com/news/ccpa-enforcement-record.html https://www.privacylawnetwork.com/news/ccpa-enforcement-record.html Tue, 01 Sep 2026 12:00:00 GMT California is the only state whose comprehensive privacy law has produced a substantial public enforcement record, and it has two enforcers producing it. This charts the twelve publicly documented CCPA actions, the penalty in each, the document each rests on, and the allegations that recur across almost all of them. CCPA / CPRA CPPA https://www.privacylawnetwork.com/news/coppa-rule-2025-amendments.html https://www.privacylawnetwork.com/news/coppa-rule-2025-amendments.html Tue, 01 Sep 2026 12:00:00 GMT The FTC published amendments to the Children's Online Privacy Protection Rule on April 22, 2025. They added a separate-consent requirement for third-party disclosure, a written retention policy and a prohibition on indefinite retention, two new categories of personal information, a written security program, and staggered obligations for safe harbor programs. COPPA FTC Enforcement Consent Management